ComboFix 17-02-24.01 - NBI 03/03/2017  16:20:54.1.4 - x64
Microsoft Windows 7 Professionnel   6.1.7601.1.1252.33.1036.18.4016.2645 [GMT 1:00]
Lancé depuis: c:\users\TEMP\Downloads\ComboFix.exe
AV: Avira Antivirus *Enabled/Updated* {B3F630BD-538D-1B4A-14FA-14B63235278F}
AV: Malwarebytes *Enabled/Updated* {23007AD3-69FE-687C-2629-D584AFFAF72B}
SP: Avira Antivirus *Enabled/Updated* {0897D159-75B7-14C4-2E4A-2FC449B26D32}
SP: Malwarebytes *Enabled/Updated* {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.pol
c:\users\NBI\AppData\Roaming\DRPSu
c:\users\NBI\AppData\Roaming\DRPSu\DrvUpdater.exe
c:\users\NBI\AppData\Roaming\DRPSu\PROGRAMS\DriverPack-Notifier.exe
c:\users\NBI\AppData\Roaming\DRPSu\PROGRAMS\OperaBlink.exe
c:\users\NBI\AppData\Roaming\DRPSu\PROGRAMS\RuntimePack.exe
c:\users\NBI\AppData\Roaming\DRPSu\PROGRAMS\WinRARx86Eng.exe
c:\users\NBI\AppData\Roaming\DRPSu\temp\patch.reg
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2017-02-03 au 2017-03-03  ))))))))))))))))))))))))))))))))))))
.
.
2017-03-03 15:26 . 2017-03-03 15:26	--------	d-----w-	c:\users\NBI\AppData\Local\temp
2017-03-03 15:26 . 2017-03-03 15:26	--------	d-----w-	c:\users\Default\AppData\Local\temp
2017-03-03 15:08 . 2017-03-03 15:15	--------	d-----w-	c:\users\NBI\AppData\Local\Chosugeretught
2017-03-03 15:08 . 2017-03-03 15:08	--------	d-----w-	c:\users\NBI\AppData\Roaming\DriverPack Notifier
2017-03-03 14:48 . 2017-03-03 14:49	--------	d-----w-	c:\users\TEMP
2017-03-03 14:13 . 2017-03-03 14:48	186304	----a-w-	c:\windows\system32\drivers\MBAMChameleon.sys
2017-03-03 14:13 . 2017-03-03 14:48	111544	----a-w-	c:\windows\system32\drivers\farflt.sys
2017-03-03 14:13 . 2017-03-03 14:48	82208	----a-w-	c:\windows\system32\drivers\mwac.sys
2017-03-03 14:13 . 2017-03-03 14:48	43968	----a-w-	c:\windows\system32\drivers\mbam.sys
2017-03-03 14:13 . 2017-03-03 14:48	251840	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2017-03-03 14:12 . 2017-02-24 05:23	77408	----a-w-	c:\windows\system32\drivers\mbae64.sys
2017-03-03 14:12 . 2017-03-03 14:12	--------	d-----w-	c:\programdata\Malwarebytes
2017-03-03 14:12 . 2017-03-03 14:12	--------	d-----w-	c:\program files\Malwarebytes
2017-03-03 13:39 . 2017-03-03 13:44	--------	d-----w-	C:\AdwCleaner
2017-03-03 10:59 . 2017-03-03 11:01	--------	d-----w-	c:\users\NBI\AppData\Roaming\ZHP
2017-03-02 23:33 . 2017-03-02 23:33	--------	d-----w-	c:\users\NBI\AppData\Local\Cybereason
2017-03-02 23:33 . 2017-03-02 23:33	--------	d-----w-	c:\users\NBI\AppData\Roaming\Cybereason
2017-03-02 23:32 . 2017-03-02 23:32	--------	d-----w-	c:\programdata\Cybereason
2017-03-02 23:32 . 2017-03-02 23:32	--------	d-----w-	c:\program files (x86)\Cybereason
2017-03-02 18:22 . 2017-03-02 18:22	--------	d-----w-	c:\programdata\Package Cache
2017-03-02 18:21 . 2017-03-02 18:21	--------	d-----w-	c:\users\NBI\AppData\Roaming\Avira
2017-03-02 18:19 . 2017-02-15 15:55	78600	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2017-03-02 18:19 . 2017-02-15 15:55	51248	----a-w-	c:\windows\system32\drivers\avusbflt.sys
2017-03-02 18:19 . 2017-02-15 15:55	35328	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2017-03-02 18:19 . 2017-02-15 15:55	176968	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2017-03-02 18:19 . 2017-02-15 15:55	148104	----a-w-	c:\windows\system32\drivers\avipbb.sys
2017-03-02 18:19 . 2017-03-02 18:22	--------	d-----w-	c:\programdata\Avira
2017-03-02 18:19 . 2017-03-02 18:22	--------	d-----w-	c:\program files (x86)\Avira
2017-03-02 09:22 . 2017-03-02 09:22	--------	d-----w-	c:\programdata\IObit
2017-03-02 08:58 . 2017-03-02 08:58	--------	d-----w-	c:\users\NBI\AppData\Roaming\Arupolereibash
2017-03-02 07:38 . 2017-03-02 07:38	--------	d-----w-	c:\users\NBI\AppData\Local\ElevatedDiagnostics
2017-03-02 07:13 . 2017-03-02 07:13	--------	d-----w-	c:\windows\Azart
2017-03-02 07:07 . 2017-03-02 07:07	--------	d-----w-	c:\users\NBI\AppData\Roaming\Profiles
2017-03-02 07:07 . 2017-03-02 10:36	--------	d-----w-	c:\program files (x86)\Fogity
2017-03-01 20:56 . 2017-03-01 20:56	--------	d-----w-	c:\users\NBI\Tracing
2017-03-01 19:00 . 2017-03-01 19:00	--------	d-----w-	c:\programdata\McAfee
2017-02-25 18:38 . 2017-03-01 22:38	--------	d-----w-	c:\users\NBI\AppData\Roaming\DRPNano
2017-02-25 09:06 . 2017-02-25 09:06	--------	d-----w-	c:\windows\system32\appmgmt
2017-02-24 17:32 . 2017-03-01 20:40	--------	d-----w-	c:\users\NBI\AppData\Local\Facebook
2017-02-24 13:10 . 2017-02-24 13:10	899184	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2017-02-24 13:10 . 2017-02-24 13:10	42168	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2017-02-24 13:10 . 2017-02-24 13:10	639312	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2017-02-24 08:56 . 2017-02-24 08:56	--------	d-----w-	c:\program files (x86)\Common Files\Skype
.
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-03-03 14:49 . 2016-02-16 17:20	180	----a-w-	c:\windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
.
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2015-12-18 298776]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-23 926896]
"avgnt"="c:\program files (x86)\Avira\Antivirus\avgnt.exe" [2017-02-15 909744]
"Avira SystrayStartTrigger"="c:\program files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe" [2017-01-19 63432]
.
c:\users\NBI\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
{Y39SN97D-K73M-YLR9-1I59-YW9R799VK9}.bmp [2017-2-28 1229254]
{Z39SN97D-K73M-YLR9-1I59-YW9R799VK9}.bmp [2017-3-2 1229254]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]
@="Service"
.
R2 AntiVirMailService;Avira Mail Protection;c:\program files (x86)\Avira\Antivirus\avmailc7.exe;c:\program files (x86)\Avira\Antivirus\avmailc7.exe [x]
R2 AntiVirWebService;Avira Web Protection;c:\program files (x86)\Avira\Antivirus\avwebg7.exe;c:\program files (x86)\Avira\Antivirus\avwebg7.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;Malwarebytes Service;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IntcDAud;Son Intel(R) pour écrans;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S0 avusbflt;avusbflt;c:\windows\System32\Drivers\avusbflt.sys;c:\windows\SYSNATIVE\Drivers\avusbflt.sys [x]
S0 iusb3hcs;Pilote de commutateur de contrôleur d'hôte Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\Antivirus\sched.exe;c:\program files (x86)\Avira\Antivirus\sched.exe [x]
S2 Avira.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\Launcher\Avira.ServiceHost.exe;c:\program files (x86)\Avira\Launcher\Avira.ServiceHost.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 CybereasonRansomFree;Cybereason RansomFree Engine;c:\program files (x86)\Cybereason\RansomFree\CybereasonRansomFreeServiceHost.exe;c:\program files (x86)\Cybereason\RansomFree\CybereasonRansomFreeServiceHost.exe [x]
S2 igfxCUIService2.0.0.0;Intel(R) HD Graphics Control Panel Service;c:\windows\system32\igfxCUIService.exe;c:\windows\SYSNATIVE\igfxCUIService.exe [x]
S3 iusb3hub;Pilote de concentrateur Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Pilote du contrôleur d'hôte extensible Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 Qcamain;Qualcomm Atheros Extensible Wireless LAN 11AC device driver;c:\windows\system32\DRIVERS\Qcamain7x64.sys;c:\windows\SYSNATIVE\DRIVERS\Qcamain7x64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 SmbDrvI;SmbDrvI;c:\windows\system32\DRIVERS\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver_Intel.sys [x]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*Deregistered* - ESProtectionDriver
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes TrayApp"="c:\program files\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe" [2017-01-20 2780112]
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.1.1 0.0.0.0
FF - ProfilePath - c:\users\TEMP\AppData\Roaming\Mozilla\Firefox\Profiles\3mw9zc5n.default\
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_223_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_223_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_223_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_223_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_223.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_223.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_223.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_223.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Heure de fin: 2017-03-03  16:29:04
ComboFix-quarantined-files.txt  2017-03-03 15:29
.
Avant-CF: 80 363 454 464 octets libres
Après-CF: 80 037 330 944 octets libres
.
- - End Of File - - E9778609DB91521281DE47A9D4E14BBB
A36C5E4F47E84449FF07ED3517B43A31